Saturday, January 27, 2024

Nmap: Getting Started Guide


Nmap is a free utility tool for network discovery, port scanning and security auditing, even though we can use it for more than that but in this article we will learn how to do these three things with nmap.

The original author of nmap is Gordon Lyon (Fyodor). Nmap is licensed under GPL v2 and has available ports in many different languages. Nmap is available for Linux, Windows, and Mac OS X. You can download your copy of nmap from their website.

Lets get started with nmap.

When performing pentests we always look for networks we are going to attack. We need to identify live hosts on the network so that we can attack them. There are plenty of tools available for finding live hosts on a network but nmap is one of the best tools for doing this job.

Lets start with simple host (target) discovery scans i,e scans that will tell us which ip address is up on our target network. Those ip addresses which are up on our target network are the ones that are assigned to a device connected on our target network. Every device on the network is going to have a unique ip address.
To perform a simple host discovery scan we use the following command

nmap -v -sn 10.10.10.0/24




flags we used in the above command are
-v for verbose output
-sn to disable port scan (we don't want to scan for ports right now)

Following the flags is the ip address of the target network on which we want to look for live hosts. The /24 at the end of the ip address is the CIDR that specifies the subnet of the network on which we are looking for live hosts.

After running the above command you should get a list of live hosts on your target network.
If you just want to know the list of ip addresses your command is going to scan, you can use the -sL flag of the nmap like this.

nmap -sL 10.10.10.0/24

this command will simply output the list of ip addresses to scan.

We sometimes want to do dns resolution (resolving ip addresses to domain names) when performing our network scans and sometimes we don't want dns resolution. While performing a host discovery scan with nmap if we want to perform dns resolution we use -R flag in our command like this:

nmap -v -sn -R 10.10.10.0/24

And if we don't want to perform dns resolution of hosts during our scan we add the -n flag to our command like this:

nmap -v -sn -n 10.10.10.0/24

After we have discovered the hosts that are up on our target network, we usually put the ip addresses of these hosts into a file for further enumeration.

Next step in our enumeration would be to detect which operating system and which ports are running on these live hosts, for that we run this command:

nmap -O -v 10.10.10.119


here we use -O (capital o not zero) for operating system detection and by default nmap performs SYN Scan for port discovery. However nmap scans for 1000 ports only by default of a particular host.

To make nmap go over a list of ip addresses in a file we use -iL flag like this:

nmap -O -v -iL targetlist

where targetlist is the name of the file which contains ip addresses that we want to perform port scan on.

To make nmap scan all the ports of a target we use the -p flag like this:

nmap -p- -v 10.10.10.121

We can also specify a range of ports using the -p flag like this:

nmap -p1-500 -v 10.10.10.121

here 1-500 means scan all the ports from 1 to 500.

We can use a number of scan techniques to discover open ports on our network but I will only discuss some of them for brevity.

We can perform a TCP SYN scan using nmap with -sS flag like this:

nmap -sS -v 10.10.10.150

We have also flags for TCP connect and ACK scans which are -sT -sA

nmap -sT -v 10.10.10.150

nmap -sA -v 10.10.10.150

We can also perform UDP scan as well instead of TCP scan using -sU flag

nmap -sU -v 10.10.10.150

We can perform TCP Null, FIN, and Xmas scans using the flags -sN, -sF, -sX

nmap -sN -v 10.10.10.150

nmap -sF -v 10.10.10.150

nmap -sX -v 10.10.10.150

If you don't know what these scans are then please visit Port Scanning Techniques and Algorithms for explanation.

After discovering the open ports on our target host, we want to enumerate what services are running on those open ports. To enumerate services and versions information on open ports we use the -sV flag like this:

nmap -sV -v 10.10.10.118

This should give us information about what services are running on what ports and what versions of those services are running on the target host.

nmap has an interesting feature called NSE nmap scripting engine. It allows users to write their own scripts, using the Lua programming language, to automate a wide variety of networking tasks. nmap ships with a diverse set of scripts which are very helpful to enumerate a target. To use the nmap default set of scripts while enumerating the target, we use the -sC flag like this:

nmap -sC -sV -v 10.10.10.118

We can also save the results of our nmap scans to a file using the -o flag like this

nmap -sC -sV -v -oA defaultscan 10.10.10.119

here -oA tells the nmap to output results in the three major formats at once and defaultscan is the name of the file that will be prepended to all the three output files.

This is the end of this short tutorial see you next time.

References:
https://nmap.org/book/scan-methods-null-fin-xmas-scan.html

Related word


  1. Tools Used For Hacking
  2. Hacking Tools For Games
  3. Hack Apps
  4. Termux Hacking Tools 2019
  5. Pentest Tools For Mac
  6. Hacker Techniques Tools And Incident Handling
  7. Pentest Tools Apk
  8. Pentest Tools Linux
  9. Pentest Tools Open Source
  10. How To Install Pentest Tools In Ubuntu
  11. Hack Rom Tools
  12. Pentest Tools Online
  13. Hacking Tools Online
  14. Pentest Tools Github
  15. Hacker Tools Apk
  16. Bluetooth Hacking Tools Kali
  17. Hacker Tools Free
  18. Tools For Hacker
  19. Game Hacking
  20. Hack And Tools
  21. Hacking Tools 2019
  22. Hacking Tools For Windows
  23. Pentest Tools List
  24. Hacking Tools Name
  25. Hack Tools Online
  26. Hack Tools For Pc
  27. Hacker Techniques Tools And Incident Handling
  28. Pentest Tools Apk
  29. Hacking Tools For Pc
  30. Wifi Hacker Tools For Windows
  31. Physical Pentest Tools
  32. Pentest Tools Bluekeep
  33. Pentest Tools
  34. Hacker Tools For Mac
  35. Hacking Tools Mac
  36. Usb Pentest Tools
  37. Hacker Tools Linux
  38. Hacking Tools Mac
  39. Hacker Tools Online
  40. Tools Used For Hacking
  41. Hack Tools Download
  42. Pentest Tools Apk
  43. Hacker Search Tools
  44. Hacking Tools
  45. Pentest Reporting Tools
  46. World No 1 Hacker Software
  47. Pentest Tools List
  48. Hack Tools
  49. Hack Tools For Games
  50. Hack Tools For Ubuntu
  51. Hacking App
  52. Hack Tools
  53. Pentest Tools Free
  54. Pentest Tools Free
  55. Growth Hacker Tools
  56. Hack Rom Tools
  57. Hack App
  58. Pentest Tools Github
  59. Hacking Tools For Windows
  60. Hacker Techniques Tools And Incident Handling
  61. Hack Tools Online
  62. Hack App
  63. Hack Tools Mac
  64. Easy Hack Tools
  65. Hacking Tools Windows
  66. Pentest Box Tools Download
  67. Hacking Tools For Games
  68. Hacking Tools Windows 10
  69. Nsa Hacker Tools
  70. Hak5 Tools
  71. Hacker
  72. Hack Tools Pc
  73. Hacking Tools And Software
  74. Ethical Hacker Tools
  75. Hacker Tools Online
  76. Black Hat Hacker Tools
  77. Pentest Reporting Tools
  78. Usb Pentest Tools
  79. Pentest Tools Url Fuzzer
  80. Hacking Tools Software
  81. Hack Tools For Pc
  82. Hacker Tools Hardware
  83. Hacking Tools Software
  84. Hacker Tool Kit
  85. Hacker Tools Linux
  86. Pentest Tools Framework
  87. Pentest Tools Github
  88. Hacking Tools For Games
  89. Hacker
  90. Hacker Techniques Tools And Incident Handling
  91. Hak5 Tools
  92. Kik Hack Tools
  93. Hacking Tools For Beginners
  94. Hack Tools Online
  95. Pentest Recon Tools
  96. Hack Tools Pc
  97. Hacking App
  98. Pentest Tools Url Fuzzer
  99. Computer Hacker
  100. Pentest Tools Website
  101. Hack Tools Github
  102. What Is Hacking Tools
  103. Hack Tools Github
  104. Pentest Tools Website Vulnerability
  105. Hack And Tools
  106. Pentest Automation Tools
  107. Termux Hacking Tools 2019
  108. Pentest Tools Bluekeep
  109. Hacking Tools Hardware
  110. Kik Hack Tools
  111. Pentest Tools Kali Linux
  112. How To Hack
  113. Termux Hacking Tools 2019
  114. Hack Tools
  115. Hack Apps
  116. Computer Hacker
  117. Hacking Tools For Windows Free Download
  118. Pentest Tools Alternative
  119. Pentest Tools Apk
  120. Wifi Hacker Tools For Windows
  121. Hack Tools Online
  122. Hacking Tools Mac
  123. Hacking Tools 2019
  124. Hack Tools For Games
  125. Hack Tool Apk
  126. Hacker Tools
  127. Top Pentest Tools
  128. Blackhat Hacker Tools
  129. Hacker Tools Windows
  130. Pentest Tools For Ubuntu
  131. Hacker Tools Online
  132. Pentest Tools For Ubuntu
  133. New Hack Tools
  134. Hacking Tools 2019
  135. Hacking Tools Windows 10
  136. Pentest Reporting Tools
  137. Ethical Hacker Tools
  138. Android Hack Tools Github
  139. Hacker Tools For Pc
  140. How To Install Pentest Tools In Ubuntu
  141. Hacker Tools Mac
  142. How To Hack
  143. Hacking Tools Usb
  144. Pentest Tools Open Source
  145. Hacking Tools For Windows
  146. Pentest Box Tools Download
  147. Hacking Tools Online
  148. Hackrf Tools
  149. Install Pentest Tools Ubuntu
  150. Underground Hacker Sites
  151. Pentest Tools Open Source
  152. What Are Hacking Tools
  153. Hacking Tools Windows 10
  154. Hack Tools For Games
  155. What Are Hacking Tools
  156. Hacking Tools 2019

No comments:

Post a Comment